Online activity management method and device based on multi-modal data, equipment and medium
By generating risk assessment values through multimodal data analysis and executing risk control operations, the problem of assessing risks from black market activities in online events has been solved, achieving efficient and accurate risk management and ensuring the fairness and system stability of online events.
Patent Information
- Application Number
- CN202510943079.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-08
- Publication Date
- 2025-11-28
AI Technical Summary
Existing online event management methods lack effective risk assessment tools, which allows criminal organizations to participate in events through improper means, resulting in the loss of welfare resources, damage to corporate interests, and impact on the fairness of customer accounts.
By acquiring multimodal data from customer accounts, we analyze device characteristics, behavior types, risk characteristics, and user request volume to generate risk assessment values. Based on the assessment value level, we execute risk control operations, including normal operation, early warning, traffic limiting, and blocking strategies.
It enables accurate risk assessment of customer accounts for online activities, reduces manual assessment time, improves risk assessment efficiency, ensures fair allocation of welfare resources, and enhances user experience and system stability.
Smart Images
Figure CN121037006A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of security, and can be applied to the field of financial technology, and in particular relates to an online activity management method and device based on multi-modal data, equipment and medium. BACKGROUND
[0002] In the Internet era, online activities break through the restrictions of time and space, and enterprises can cover a wider range of customers at a lower cost. Customers can easily participate in activities regardless of their location, and online activities are flexible and diverse, and can quickly respond to market changes and customer needs. Through interesting interactions and personalized experiences, customer participation and loyalty are enhanced, laying a solid foundation for long-term and stable relationships between enterprises and customers.
[0003] However, the existing online activity management method lacks effective and accurate risk assessment methods and mechanisms, so it is difficult to determine the risk of customer accounts during the activity execution phase. At this time, black production organizations will use improper means to participate in activities, resulting in a large number of welfare resources falling into the hands of black production organizations. This not only damages the interests of enterprises, but also causes customer accounts to miss the benefits they deserve. Therefore, how to assess the risk of customer accounts participating in online activities is a technical problem that needs to be solved. SUMMARY
[0004] The present application provides an online activity management method and device based on multi-modal data, a computer device and a storage medium to solve the technical problem of how to assess the risk of customer accounts participating in online activities.
[0005] In a first aspect, an online activity management method based on multi-modal data is provided, comprising:
[0006] Obtaining a participation request sent by a client device;
[0007] Obtaining a customer account participating in an online activity from the participation request, and obtaining multi-modal data of the customer account;
[0008] Obtaining a plurality of device feature information, a current behavior type, a risk feature information and a user request volume from the multi-modal data;
[0009] Determining a device abnormality degree based on the plurality of device feature information, determining a behavior deviation degree based on the current behavior type, determining a network risk value based on the risk feature information, and determining a resource consumption based on the user request volume;
[0010] Generating a risk assessment value according to the device abnormality degree, the behavior deviation degree, the network risk value and the resource consumption;
[0011] The level corresponding to the risk assessment value is obtained, the level corresponding to the risk assessment value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account.
[0012] Further, the customer account participating in the online activity is obtained from the participation request, and the multi-modal data of the customer account is obtained, including:
[0013] The customer account participating in the online activity is obtained from the participation request, and the data acquisition request is sent to the customer account;
[0014] The response message returned by the customer account according to the data acquisition request is received, and when the response message is a pass message, the multi-modal data of the customer account is obtained.
[0015] Further, the multi-item device feature information, the current behavior type, the risk feature information and the user request quantity are obtained from the multi-modal data, including:
[0016] Accessing a plurality of files corresponding to the multi-modal data, the plurality of files including a first file, a second file, a third file and a fourth file;
[0017] The multi-item device feature information is obtained from the first file, the current behavior type is obtained from the second file, the risk feature information is obtained from the third file, and the user request quantity is obtained from the fourth file.
[0018] Further, the device abnormality degree is determined based on the multi-item device feature information, the behavior deviation degree is determined based on the current behavior type, the network risk value is determined based on the risk feature information, and the resource consumption quantity is determined based on the user request quantity, including:
[0019] Obtaining a device abnormality degree generation model, a behavior deviation degree generation model, a network risk value generation model and a resource consumption quantity generation model;
[0020] According to the multi-item device feature information and the device abnormality degree generation model, the device abnormality degree is generated, according to the feature vector of the current behavior type and the behavior deviation degree generation model, the behavior deviation degree is generated, according to the risk feature information and the network risk value generation model, the network risk value is generated, and according to the user request quantity and the resource consumption quantity generation model, the resource consumption quantity is generated.
[0021] Further, the risk assessment value is generated according to the device abnormality degree, the behavior deviation degree, the network risk value and the resource consumption quantity, including:
[0022] Obtaining a first weight coefficient corresponding to the device abnormality degree, a second weight coefficient corresponding to the behavior deviation degree, a third weight coefficient corresponding to the network risk value, and a fourth weight coefficient corresponding to the resource consumption quantity;
[0023] According to the first weight coefficient, the second weight coefficient, the third weight coefficient, the fourth weight coefficient, the device abnormality degree, the behavior deviation degree, the network risk value, the resource consumption, and the risk assessment model, a risk assessment value is generated.
[0024] Further, the level corresponding to the risk assessment value is obtained, and the level corresponding to the risk assessment value is selected as the risk level of the customer account.
[0025] The level corresponding to the risk assessment value is obtained, and the level corresponding to the risk assessment value is selected as the risk level of the customer account.
[0026] When the risk level of the customer account is a low risk level, normal operation is performed on the customer account, when the risk level of the customer account is a medium risk level, early warning operation and flow limiting operation are performed on the customer account, and when the risk level of the customer account is a high risk level, blocking operation and attack path tracing operation are performed on the customer account.
[0027] Further, the model is generated according to the risk feature information and the network risk value, and the network risk value is generated, including:
[0028] The historical attack record, the geographic location information, the network service provider information, the domain name resolution record, and the IP geographic positioning result are obtained from the risk feature information; the historical attack record, the geographic location information, and the network service provider information are risk assessed to obtain a first risk value, the domain name resolution record is risk assessed to obtain a second risk value, and the IP geographic positioning result is risk assessed to obtain a third risk value; and the first risk value, the second risk value, the third risk value, and the network risk value generation model are used to generate the network risk value.
[0029] In a second aspect, an online activity management device based on multi-modal data is provided, including:
[0030] The first obtaining module is configured to obtain a participation request sent by a client device.
[0031] The second obtaining module is configured to obtain a customer account participating in an online activity from the participation request, and obtain multi-modal data of the customer account.
[0032] The third obtaining module is configured to obtain a plurality of device feature information, a current behavior type, risk feature information, and a user request volume from the multi-modal data.
[0033] The determining module is configured to determine a device abnormality degree based on the plurality of device feature information, determine a behavior deviation degree based on the current behavior type, determine a network risk value based on the risk feature information, and determine a resource consumption based on the user request volume.
[0034] The generating module is configured to generate a risk evaluation value according to the device anomaly degree, the behavior deviation degree, the network risk value, and the resource consumption amount.
[0035] The management module is configured to obtain a level corresponding to the risk evaluation value, select the level corresponding to the risk evaluation value as a risk level of the customer account, and perform a risk control operation on the customer account according to the risk level of the customer account.
[0036] In a third aspect, a computer device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the online activity management method when executing the computer program.
[0037] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program implements the steps of the online activity management method when executed by a processor.
[0038] The online activity management method, device, computer device, and storage medium provided by the present application have two beneficial effects. On the one hand, the level corresponding to the risk evaluation value is obtained, the level corresponding to the risk evaluation value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account, thereby solving the problem of how to perform risk evaluation on the customer account participating in the online activity. On the other hand, since the risk evaluation is automatically performed on the customer account participating in the online activity, manual evaluation is not required, thereby reducing the risk evaluation time of the customer account participating in the online activity and improving the risk evaluation efficiency of the customer account. BRIEF DESCRIPTION OF DRAWINGS
[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.
[0040] Figure 1 is an application environment schematic diagram of the online activity management method in an embodiment of the present application;
[0041] Figure 2 is a flow schematic diagram of the online activity management method provided by an embodiment of the present application;
[0042] Figure 3 is Figure 2 is a specific implementation flow schematic diagram of step S23 in the embodiment;
[0043] Figure 4 is Figure 2is a specific embodiment flowchart of step S25 in the method;
[0044] Figure 5 is Figure 2 is a specific embodiment flowchart of step S26 in the method;
[0045] Figure 6 is a structural schematic diagram of an online activity management device in an embodiment of the present application;
[0046] Figure 7 is a structural schematic diagram of a computer device in an embodiment of the present application;
[0047] Figure 8 is another structural schematic diagram of a computer device in an embodiment of the present application. DETAILED DESCRIPTION
[0048] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.
[0049] Please refer to Figure 1 , Figure 1 is a schematic diagram of an application environment of an online activity management method in an embodiment of the present application. The online activity management method provided in the embodiments of the present application can be applied in an application environment as shown in Figure 1 , wherein the client device communicates with the server device through a network.
[0050] The server device receives a participation request sent by the client device;
[0051] Obtains a client account participating in the online activity from the participation request, and obtains multi-modal data of the client account;
[0052] Obtains a plurality of device feature information, a current behavior type, risk feature information and a user request volume from the multi-modal data;
[0053] Determines a device abnormality degree based on the plurality of device feature information, determines a behavior deviation degree based on the current behavior type, determines a network risk value based on the risk feature information, and determines a resource consumption based on the user request volume;
[0054] Generates a risk evaluation value according to the device abnormality degree, the behavior deviation degree, the network risk value and the resource consumption;
[0055] The level corresponding to the risk assessment value is obtained, the level corresponding to the risk assessment value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account.
[0056] In the scheme implemented by the online activity management method, device, equipment and medium, the beneficial effects are in two aspects. On the one hand, the level corresponding to the risk assessment value is obtained, the level corresponding to the risk assessment value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account, which solves the problem of how to perform risk assessment on the customer account participating in the online activity. On the other hand, since the risk assessment of the customer account participating in the online activity is automatically performed, manual assessment is not required, thereby reducing the risk assessment time of the customer account participating in the online activity, and the risk assessment efficiency of the customer account is improved.
[0057] The server device can be implemented by an independent server or a server cluster composed of multiple servers. The application will be described in detail through specific embodiments.
[0058] Please refer to Figure 2 , Figure 2 A flowchart of an online activity management method provided by an embodiment of the application includes the following steps:
[0059] S21, obtaining a participation request sent by a client device;
[0060] The participation request is a request to participate in an online activity.
[0061] The client device can include, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices.
[0062] S22, obtaining a customer account participating in an online activity from the participation request, and obtaining multi-modal data of the customer account;
[0063] The multi-modal data of the customer account includes:
[0064] The multi-modal data of the customer account includes:
[0065] The multi-modal data of the customer account includes:
[0066] S23, obtaining a plurality of device feature information, a current behavior type, risk feature information and a user request volume from the multi-modal data;
[0067] The plurality of device characteristic information includes GPU clock jitter rate, memory fragmentation entropy, CPU micro-architecture fingerprint, screen touch noise, battery charge and discharge curve, sensor calibration offset, baseband chip delay, audio codec feature, thermal design power consumption curve, wireless module fingerprint, graphics rendering fingerprint, and security chip signature.
[0068] The GPU clock jitter rate refers to the fluctuation degree of the frequency of a GPU clock signal.
[0069] The memory fragmentation entropy is a quantitative index for measuring the degree of memory fragmentation.
[0070] The CPU micro-architecture fingerprint refers to the unique features or identification of a CPU (central processing unit) at the micro-architecture level.
[0071] The screen touch noise refers to signal interference or error on a touch screen device caused by touch operation, electromagnetic interference, hardware design, and other factors.
[0072] The battery charge and discharge curve is a graphical representation of the changes in key parameters such as voltage, current, and capacity of the battery over time during charging or discharging.
[0073] The sensor calibration offset refers to the fixed deviation between the output value and the true value of a sensor after calibration.
[0074] The baseband chip delay refers to the time delay experienced from signal input to output when the baseband chip processes signals.
[0075] The audio codec feature refers to the technical parameters of an audio encoder and decoder during the encoding and decoding of audio signals.
[0076] The thermal design power consumption curve describes the trend of the heating power of a device under different workloads or operating conditions over time or other factors.
[0077] The wireless module fingerprint refers to the unique identification of a wireless module during communication.
[0078] The graphics rendering fingerprint refers to the unique features or identification of a graphics processor during graphics rendering.
[0079] The security chip signature is a unique identification generated by encrypting data using the encryption algorithm and key inside the security chip.
[0080] S24, determine the device anomaly degree based on the plurality of device feature information, determine the behavior deviation degree based on the current behavior type, determine the network risk value based on the risk feature information, and determine the resource consumption amount based on the user request amount;
[0081] The device anomaly degree is determined based on the plurality of device feature information, the behavior deviation degree is determined based on the current behavior type, the network risk value is determined based on the risk feature information, and the resource consumption amount is determined based on the user request amount.
[0082] The device anomaly degree generation model, the behavior deviation degree generation model, the network risk value generation model, and the resource consumption amount generation model are obtained.
[0083] The device anomaly degree is generated based on the plurality of device feature information and the device anomaly degree generation model, the behavior deviation degree is generated based on the feature vector of the current behavior type and the behavior deviation degree generation model, the network risk value is generated based on the risk feature information and the network risk value generation model, and the resource consumption amount is generated based on the user request amount and the resource consumption amount generation model.
[0084] The device anomaly degree generation model is:
[0085]
[0086] α represents the device anomaly degree;
[0087] xi represents the measured value of the i-th device feature information.
[0088] ui represents the mean value of the i-th normal device feature information;
[0089] σi represents the standard deviation of the i-th normal device feature information.
[0090] The behavior deviation degree model is:
[0091]
[0092] β represents the behavior deviation degree;
[0093] x represents the feature vector of the current behavior type;
[0094] M represents the number of clusters of the Gaussian mixture model;
[0095] π k represents the weight coefficient of the k-th behavior type;
[0096] T represents the transpose operation;
[0097] The value range of k is from 1 to K;
[0098] u k represents the mean vector of the k-th behavior type;
[0099] an inverse matrix of the covariance matrix of the k behavior types.
[0100] wherein the resource consumption model is:
[0101]
[0102] delta represents the resource consumption amount; max represents a function of finding the maximum value; C represents the user request amount; t represents time; represents the change rate of the user request amount growth rate per unit time; tau represents a threshold value.
[0103] wherein the threshold value = mean value of baseline data + standard deviation of baseline data x 3.
[0104] wherein since black production often uses automated tools to mass-produce false requests, these false requests do not come from real user demand, but can instantly cause the user request amount growth rate to abnormally skyrocket, such as a sudden sharp increase in the originally smooth growth rate, since these false requests have no actual business value, but still need to be processed by the system, the system has to allocate a large amount of resources to deal with it, thereby causing the resource consumption amount to increase significantly in a short period of time. This abnormal resource consumption not only increases the server burden, causing the system performance to decline, but also may cause the risk of resource depletion, affecting the access experience of normal users, and even causing system crashes and other serious consequences. Therefore, by monitoring the abnormal situation of the user request amount growth rate, black production activities can be discovered in time, and the resource consumption amount can be effectively controlled to ensure the stable operation of the system.
[0105] wherein the generating the network risk value according to the risk feature information and the network risk value generation model comprises:
[0106] obtaining historical attack records, geographic location information, network service provider information, domain name resolution records and IP geographic positioning results from the risk feature information;
[0107] performing risk assessment on the historical attack records, the geographic location information and the network service provider information to obtain a first risk value, performing risk assessment on the domain name resolution records to obtain a second risk value, performing risk assessment on the IP geographic positioning results to obtain a third risk value, and generating the network risk value according to the first risk value, the second risk value, the third risk value and the network risk value generation model.
[0108] The historical attack record, geographical position information and network service provider information are risk evaluated to obtain a first risk value, the domain name resolution record is risk evaluated to obtain a second risk value, the IP geographical positioning result is risk evaluated to obtain a third risk value, and a network risk value is generated according to a network risk value generation model based on the first risk value, the second risk value, the third risk value and the network risk value, and the network risk value comprises:
[0109] The historical attack record, geographical position information and network service provider information are risk evaluated by using an artificial intelligence model to obtain a first risk value, the domain name resolution record is checked for association with a black production domain name to obtain a checking result, a risk value corresponding to the checking result is selected as a second risk value, and the base station positioning result of the client device is checked for consistency with the IP geographical positioning result to obtain a consistency checking result, a risk value corresponding to the consistency checking result is selected as a third risk value, and a network risk value is generated according to a network risk value generation model based on the first risk value, the second risk value, the third risk value and the network risk value.
[0110] The checking result is an association result or a non-association result. The consistency checking result is an inconsistency result or a consistency result.
[0111] The network risk value generation model is:
[0112] γ = 60% * P1 + 30% * P2 + 10% * P3;
[0113] γ represents the network risk value; P1 represents the first risk value; P2 represents the second risk value; and P3 represents the third risk value.
[0114] S25, generating a risk evaluation value according to the device abnormality degree, the behavior deviation degree, the network risk value and the resource consumption amount;
[0115] The device abnormality degree can capture potential risk signals at the device level, the behavior deviation degree focuses on user behavior patterns, the network risk value can intuitively reflect the potential network threat degree of the client account, and the resource consumption amount considers the occupation of system resources by the client account from the actual operation perspective.
[0116] The risk evaluation value is generated according to the device abnormality degree, the behavior deviation degree, the network risk value and the resource consumption amount, which can understand potential threats from the hardware device level and the user behavior level, greatly improving the accuracy of the risk evaluation value.
[0117] S26, obtaining a level corresponding to the risk evaluation value, selecting the level corresponding to the risk evaluation value as the risk level of the client account, and performing a risk control operation on the client account according to the risk level of the client account.
[0118] According to the risk level of the customer account, the risk control operation is performed on the customer account, the abnormal account manipulated by the black production can be accurately identified, and the abnormal account is excluded from the benefit receiving range, so that the benefit resources can be fairly and reasonably distributed to the real customer account, and the user satisfaction and participation in the benefit activity are improved.
[0119] For the sake of illustration, taking the field of financial technology as an example, the following is given:
[0120] The benefit resources issued by the financial technology platform often involve funds, such as cash red packets, investment coupons, etc. After the black production seizes these resources, it may transfer funds through money laundering and other illegal means, bringing financial security risks and compliance problems to the financial technology platform. According to the risk level of the customer account, the risk control operation is performed on the customer account, the high-risk account can be accurately identified, and the black production is prevented from obtaining the benefit resources, so that the funds can flow within the legal and compliant framework.
[0121] In the embodiment of the application, the beneficial effects are in two aspects. On the one hand, the level corresponding to the risk assessment value is obtained, the level corresponding to the risk assessment value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account, solving the problem of how to assess the risk of the customer account participating in the online activity. On the other hand, since the customer account participating in the online activity is automatically assessed, manual assessment is not required, thus reducing the risk assessment time of the customer account participating in the online activity, and being conducive to improving the risk assessment efficiency of the customer account.
[0122] Please refer to Figure 3 , Figure 3 is Figure 2 a specific implementation process schematic diagram of step S23 in
[0123] S31, access a plurality of files corresponding to the multi-modal data, the plurality of files including a first file, a second file, a third file and a fourth file;
[0124] S32, obtaining a plurality of device feature information from the first file, obtaining a current behavior type from the second file, obtaining risk feature information from the third file, and obtaining user request quantity from the fourth file.
[0125] In the embodiment of the application, the multi-modal data is dispersed in the first file, the second file, the third file and the fourth file, the plurality of device feature information is obtained from the first file, the current behavior type is obtained from the second file, the risk feature information is obtained from the third file, and the user request quantity is obtained from the fourth file. In this way, the required data can be quickly obtained.
[0126] Please refer to Figure 4 , Figure 4 is Figure 2A specific embodiment flowchart of step S25 in the method is shown in the following and will be described in detail.
[0127] S41, acquire the first weight coefficient corresponding to the device abnormality degree, the second weight coefficient corresponding to the behavior deviation degree, the third weight coefficient corresponding to the network risk value, and the fourth weight coefficient corresponding to the resource consumption amount;
[0128] S42, generate a risk assessment value according to the first weight coefficient, the second weight coefficient, the third weight coefficient, the fourth weight coefficient, the device abnormality degree, the behavior deviation degree, the network risk value, the resource consumption amount, and a risk assessment model.
[0129] The risk assessment model is as follows:
[0130] R = w1 x a + w2 x b + w3 x g + w4 x d;
[0131] R represents the risk assessment value; w1 is the first weight coefficient, w2 is the second weight coefficient, w3 is the third weight coefficient, and w4 is the fourth weight coefficient; a represents the device abnormality degree; b represents the behavior deviation degree; g represents the network risk value, and d represents the resource consumption amount.
[0132] In the embodiment of the application, the risk assessment value is generated, which can effectively intercept black production behaviors, avoid unnecessary cost waste, and enable enterprises to more accurately invest resources in improving user experience and service quality.
[0133] Please refer to Figure 5 , Figure 5 is Figure 2 A specific embodiment flowchart of step S26 in the method is shown in the following and will be described in detail.
[0134] S51, acquire the level corresponding to the risk assessment value, and select the level corresponding to the risk assessment value as the risk level of the customer account;
[0135] S52, when the risk level of the customer account is a low risk level, perform normal operation on the customer account; when the risk level of the customer account is a medium risk level, perform early warning operation and flow limiting operation on the customer account; and when the risk level of the customer account is a high risk level, perform blocking operation and attack path tracing operation on the customer account.
[0136] In the embodiment of the application, different risk levels are adapted to different operation strategies, and the calculation, storage, and network resources can be reasonably allocated. The hierarchical operation is beneficial to improving the resource use efficiency.
[0137] Please refer to Figure 6 , Figure 6 is a structural schematic diagram of an online activity management device in an embodiment of the application, as shown in Figure 6As shown, the online activity management apparatus includes a first acquisition module 101, a second acquisition module 102, a third acquisition module 103, a determination module 104, a generation module 105, and a management module 106. The functions of the modules are described in detail as follows:
[0138] The first acquisition module 101 is configured to acquire a participation request sent by a client device.
[0139] The second acquisition module 102 is configured to acquire a client account participating in an online activity from the participation request and acquire multi-modal data of the client account.
[0140] The third acquisition module 103 is configured to acquire a plurality of device feature information, a current behavior type, risk feature information, and a user request volume from the multi-modal data.
[0141] The determination module 104 is configured to determine a device abnormality degree based on the plurality of device feature information, determine a behavior deviation degree based on the current behavior type, determine a network risk value based on the risk feature information, and determine a resource consumption volume based on the user request volume.
[0142] The generation module 105 is configured to generate a risk assessment value according to the device abnormality degree, the behavior deviation degree, the network risk value, and the resource consumption volume.
[0143] The management module 106 is configured to acquire a level corresponding to the risk assessment value, select the level corresponding to the risk assessment value as a risk level of the client account, and perform a risk control operation on the client account according to the risk level of the client account.
[0144] In an embodiment, the second acquisition module 102 includes:
[0145] A first acquisition unit is configured to acquire a client account participating in an online activity from a participation request and send a data acquisition request to the client account.
[0146] A second acquisition unit is configured to receive a response message returned by the client account according to the data acquisition request and acquire multi-modal data of the client account when the response message is a pass message.
[0147] In an embodiment, the third acquisition module 103 includes:
[0148] An access unit is configured to access a plurality of files corresponding to the multi-modal data, and the plurality of files include a first file, a second file, a third file, and a fourth file.
[0149] A third acquisition unit is configured to acquire a plurality of device feature information from the first file, acquire a current behavior type from the second file, acquire risk feature information from the third file, and acquire a user request volume from the fourth file.
[0150] In an embodiment, the determining module 104 comprises:
[0151] A fourth obtaining unit is configured to obtain the device anomaly degree generation model, the behavior deviation degree generation model, the network risk value generation model and the resource consumption amount generation model.
[0152] A generating unit is configured to generate the device anomaly degree according to the plurality of device feature information and the device anomaly degree generation model, generate the behavior deviation degree according to the feature vector of the current behavior type and the behavior deviation degree generation model, generate the network risk value according to the risk feature information and the network risk value generation model, and generate the resource consumption amount according to the user request amount and the resource consumption amount generation model.
[0153] In an embodiment, the generating module 105 comprises:
[0154] A fifth obtaining unit is configured to obtain a first weight coefficient corresponding to the device anomaly degree, a second weight coefficient corresponding to the behavior deviation degree, a third weight coefficient corresponding to the network risk value, and a fourth weight coefficient corresponding to the resource consumption amount.
[0155] The generating unit is configured to generate the risk assessment value according to the first weight coefficient, the second weight coefficient, the third weight coefficient, the fourth weight coefficient, the device anomaly degree, the behavior deviation degree, the network risk value, the resource consumption amount and the risk assessment model.
[0156] In an embodiment, the management module 106 comprises:
[0157] A selecting unit is configured to obtain a level corresponding to the risk assessment value, and select the level corresponding to the risk assessment value as the risk level of the customer account.
[0158] A management unit is configured to perform normal operation on the customer account when the risk level of the customer account is a low risk level, perform pre-warning operation and flow limiting operation on the customer account when the risk level of the customer account is a medium risk level, and perform blocking operation and attack path tracing operation on the customer account when the risk level of the customer account is a high risk level.
[0159] In an embodiment, the generating unit further comprises:
[0160] An obtaining sub-unit is configured to obtain historical attack records, geographic location information, network service provider information, domain name resolution records and IP geographic positioning results from the risk feature information.
[0161] The generating sub-unit is configured to perform risk assessment on the historical attack records, the geographic location information, and the network service provider information to obtain a first risk value, perform risk assessment on the domain name resolution records to obtain a second risk value, perform risk assessment on the IP geographic positioning result to obtain a third risk value, and generate a network risk value according to the first risk value, the second risk value, the third risk value, and a network risk value generation model.
[0162] In the embodiments of the present application, the beneficial effects are in two aspects. On the one hand, the level corresponding to the risk assessment value is obtained, the level corresponding to the risk assessment value is selected as the risk level of the customer account, and the risk control operation is performed on the customer account according to the risk level of the customer account, thereby solving the problem of how to perform risk assessment on the customer account participating in the online activity. On the other hand, since the risk assessment is automatically performed on the customer account participating in the online activity, manual assessment is not required, thereby reducing the risk assessment time of the customer account participating in the online activity, and the risk assessment efficiency of the customer account is improved.
[0163] The specific limitations of the online activity management device can be referred to the limitations of the online activity management method in the above, which will not be repeated here.
[0164] The above modules in the online activity management device can be realized by software, hardware and combinations thereof in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above modules.
[0165] Please refer to Figure 7 , Figure 7 is a structural schematic diagram of a computer device in an embodiment of the present application. In an embodiment, a computer device is provided, which can be a server device, and the internal structure diagram thereof can be as shown in Figure 7 The computer device includes a processor, a memory, a network interface and a database connected through a system bus.
[0166] The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the functions or steps of an online activity management method based on multi-modal data can be implemented on the server device.
[0167] Please refer to Figure 8 , Figure 8is another structural schematic diagram of a computer device in an embodiment of the present application. In an embodiment, a computer device is provided, which can also be a server device, and an internal structure diagram of the computer device can be as shown in Figure 8 The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus.
[0168] It should be noted that the functions or steps that the computer readable storage medium or the computer device can achieve described above can be referred to the related description in the foregoing method embodiments, and to avoid repetition, they will not be described one by one here.
[0169] The processor described above can be a general processor, including a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP) and the like; and can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.
[0170] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment and the like) can be implemented in other ways. For example, the device embodiments described above are merely schematic, for example, the division of units can be merely a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some sub-samples can be ignored or not executed. In addition, each functional unit in the embodiments of the present disclosure can be integrated in one processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit.
[0171] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (media) having exact sequences of instructions, program, code segments, or computer instructions, which is designed and configured to direct, manage, and control the functions of one or more computers or computer systems, and is recorded on a computer- readable medium (media) to prepare a machine, such that the instructions, program, code segments, or computer instructions recorded on the computer-readable medium (media) are used to implement various functions of the system and the method according to the present disclosure.
Claims
1. A method for online activity management based on multimodal data, characterized in that, include: Obtain the participation request sent by the client device; Obtain customer accounts participating in online activities from participation requests, and acquire multimodal data of customer accounts; Extract multiple device characteristic information, current behavior type, risk characteristic information, and user request volume from multimodal data; The anomaly level of a device is determined based on multiple device characteristic information, the deviation of behavior is determined based on the current behavior type, the network risk value is determined based on risk characteristic information, and the resource consumption is determined based on the user request volume. A risk assessment value is generated based on the degree of equipment anomaly, the degree of behavioral deviation, the network risk value, and the resource consumption. Obtain the level corresponding to the risk assessment value, select the level corresponding to the risk assessment value as the risk level of the customer account, and perform risk control operations on the customer account according to the risk level of the customer account.
2. The online activity management method according to claim 1, characterized in that, The step of obtaining the customer account for participating in the online activity from the participation request, and obtaining the multimodal data of the customer account, includes: Obtain the customer accounts participating in the online activity from the participation requests, and send data retrieval requests to the customer accounts; Receive the response message returned by the customer account based on the data retrieval request. When the response message is an approved message, retrieve the multimodal data of the customer account.
3. The online activity management method according to claim 1, characterized in that, The process of obtaining multiple device characteristic information, current behavior type, risk characteristic information, and user request volume from multimodal data includes: Access multiple files corresponding to multimodal data, including a first file, a second file, a third file, and a fourth file; The system retrieves multiple device characteristic information from the first file, the current behavior type from the second file, risk characteristic information from the third file, and the number of user requests from the fourth file.
4. The online activity management method according to claim 1, characterized in that, The process of determining device anomaly based on multiple device characteristic information, determining behavior deviation based on current behavior type, determining network risk value based on risk characteristic information, and determining resource consumption based on user request volume includes: Obtain device anomaly generation model, behavior deviation generation model, network risk value generation model, and resource consumption generation model; Based on multiple device feature information and a device anomaly generation model, a device anomaly degree is generated. Based on the feature vector of the current behavior type and a behavior deviation generation model, a behavior deviation degree is generated. Based on risk feature information and a network risk value generation model, a network risk value is generated. Based on user request volume and resource consumption generation model, resource consumption is generated.
5. The online activity management method according to claim 1, characterized in that, The risk assessment value is generated based on device anomaly degree, behavior deviation degree, network risk value, and resource consumption, including: Obtain the first weight coefficient corresponding to the device anomaly degree, the second weight coefficient corresponding to the behavior deviation degree, the third weight coefficient corresponding to the network risk value, and the fourth weight coefficient corresponding to the resource consumption. A risk assessment value is generated based on the first weighting coefficient, the second weighting coefficient, the third weighting coefficient, the fourth weighting coefficient, the equipment anomaly degree, the behavior deviation degree, the network risk value, the resource consumption, and the risk assessment model.
6. The online activity management method according to claim 1, characterized in that, The process of obtaining the level corresponding to the risk assessment value, selecting the level corresponding to the risk assessment value as the risk level of the customer account, and performing risk control operations on the customer account based on the risk level of the customer account includes: Obtain the level corresponding to the risk assessment value, and select the level corresponding to the risk assessment value as the risk level of the customer account; When the risk level of a customer account is low, normal operations are performed on the customer account. When the risk level of a customer account is medium, warning operations and rate limiting operations are performed on the customer account. When the risk level of a customer account is high, blocking operations and attack path tracing operations are performed on the customer account.
7. The online activity management method according to claim 4, characterized in that, The process of generating network risk values based on risk characteristic information and a network risk value generation model includes: Extract historical attack records, geographic location information, network service provider information, domain name resolution records, and IP geolocation results from risk characteristic information; Risk assessments are performed on historical attack records, geographic location information, and network service provider information to obtain a first risk value. Risk assessments are performed on domain name resolution records to obtain a second risk value. Risk assessments are performed on IP geographic location results to obtain a third risk value. Based on the first, second, and third risk values and the network risk value generation model, a network risk value is generated.
8. An online activity management device based on multimodal data, characterized in that, include: The first acquisition module is used to acquire participation requests sent by the client device; The second acquisition module is used to obtain customer accounts participating in online activities from participation requests and to obtain multimodal data of customer accounts; The third acquisition module is used to acquire multiple device feature information, current behavior type, risk feature information, and user request volume from multimodal data; The determination module is used to determine the degree of device anomaly based on multiple device characteristic information, determine the degree of behavior deviation based on the current behavior type, determine the network risk value based on risk characteristic information, and determine the resource consumption based on the user request volume. The generation module is used to generate risk assessment values based on device anomaly degree, behavior deviation degree, network risk value, and resource consumption. The management module is used to obtain the level corresponding to the risk assessment value, select the level corresponding to the risk assessment value as the risk level of the customer account, and perform risk control operations on the customer account according to the risk level of the customer account.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the online activity management method as described in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the online activity management method as described in any one of claims 1 to 7.